<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="3.10.0">Jekyll</generator><link href="https://brokenco.de//feed/by_tag/feathersjs.xml" rel="self" type="application/atom+xml" /><link href="https://brokenco.de//" rel="alternate" type="text/html" /><updated>2026-05-03T00:12:50+00:00</updated><id>https://brokenco.de//feed/by_tag/feathersjs.xml</id><title type="html">rtyler</title><subtitle>a moderately technical blog</subtitle><author><name>R. Tyler Croy</name></author><entry><title type="html">Feathers authentication for web pages and forms</title><link href="https://brokenco.de//2018/09/21/feathers-form-authentication.html" rel="alternate" type="text/html" title="Feathers authentication for web pages and forms" /><published>2018-09-21T00:00:00+00:00</published><updated>2018-09-21T00:00:00+00:00</updated><id>https://brokenco.de//2018/09/21/feathers-form-authentication</id><content type="html" xml:base="https://brokenco.de//2018/09/21/feathers-form-authentication.html"><![CDATA[<p>I have been using <a href="http://feathersjs.com">Feathers</a> for a number of projects
lately, including the backend and client for <a href="https://jenkins.io/projects/evergreen">Jenkins
Evergreen</a>. 
It is obvious from the design and structure of Feathers that a significant
amount of thought went into its development.  Overall, I have been happy with
the experience implementing clean APIs, and have added Feathers as my default
toolchain for new web API and application development. Feathers has been great
for building JSON-based RESTful APIs, but I stumbled over some hurdles when
using it as a more traditional web application framework.</p>

<p>The simplest to fix, but most frustrating to stumble over, was utilizing
<a href="https://docs.feathersjs.com/api/authentication/server.html">Feathers
Authentication</a>
when serving <a href="https://docs.feathersjs.com/guides/advanced/using-a-view-engine.html">views via
Feathers</a>.
By default, the authentication in Feathers utilizes a <a href="https://jwt.io">JSON
Web Token</a> for capturing the current authentication status of a
request. When using the
<a href="https://docs.feathersjs.com/api/authentication/oauth2.html">OAuth2</a>
authentication mechanism, it is possible to tell Feathers to set a cookie with
the JSON Web Token.</p>

<p>Then, when adding authorization in front of a Feathers service, it’s as simple as
adding a hook:</p>

<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="p">{</span>
  <span class="nl">before</span><span class="p">:</span> <span class="p">{</span>
    <span class="na">all</span><span class="p">:</span> <span class="p">[</span>
      <span class="nx">authentication</span><span class="p">.</span><span class="nx">hooks</span><span class="p">.</span><span class="nx">authenticate</span><span class="p">([</span><span class="dl">'</span><span class="s1">jwt</span><span class="dl">'</span><span class="p">]),</span>
    <span class="p">],</span>
  <span class="p">},</span>
  <span class="nx">after</span><span class="p">:</span> <span class="p">{</span>
  <span class="p">},</span>
  <span class="nx">error</span><span class="p">:</span> <span class="p">{</span>
  <span class="p">},</span>
<span class="p">};</span>
</code></pre></div></div>

<p>Unfortunately even with that cookie set, a browser accessing the service, this
results in “Not Authentication” errors.</p>

<p>After a bit of searching around I eventually discovered some references to what
I <em>thought</em> might solve my problem on this page titled:
<a href="https://docs.feathersjs.com/guides/auth/recipe.express-middleware.html">FeathersJS Auth Recipe: Authenticating Express middleware (SSR)</a>.</p>

<p>By default, though the OAuth2 authentication module for Feathers will <em>set</em> a
cookie, it doesn’t appear to do anything by default to <em>read</em> that same cookie.
One must install and use the <code class="language-plaintext highlighter-rouge">cookie-parser</code> package.</p>

<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>$ npm install --save cookie-parser
</code></pre></div></div>

<p>Once the <code class="language-plaintext highlighter-rouge">cookie-parser</code> package has been installed, it’s important that it
gets added as the first middleware in the application.</p>

<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kd">const</span> <span class="nx">cookieParser</span> <span class="o">=</span> <span class="nx">require</span><span class="p">(</span><span class="dl">'</span><span class="s1">cookie-parser</span><span class="dl">'</span><span class="p">);</span>
<span class="cm">/*
 * Add the cookie parser to GET routes
 */</span>
<span class="nx">app</span><span class="p">.</span><span class="kd">get</span><span class="p">(</span><span class="dl">'</span><span class="s1">*</span><span class="dl">'</span><span class="p">,</span> <span class="nx">cookieParser</span><span class="p">());</span>
<span class="cm">/*
 * Add the cookie parser to POST routes
 */</span>
<span class="nx">app</span><span class="p">.</span><span class="nx">post</span><span class="p">(</span><span class="dl">'</span><span class="s1">*</span><span class="dl">'</span><span class="p">,</span> <span class="nx">cookieParser</span><span class="p">());</span>
</code></pre></div></div>

<p>With this package installed and configured, the JWT cookie will be parsed
properly when for requests coming in to the application. This ensures that the
<code class="language-plaintext highlighter-rouge">authentication.hooks.authenticate(['jwt'])</code> hook has the appropriate material
it needs to perform the authentication.</p>]]></content><author><name>R. Tyler Croy</name></author><category term="javascript" /><category term="feathersjs" /><summary type="html"><![CDATA[I have been using Feathers for a number of projects lately, including the backend and client for Jenkins Evergreen. It is obvious from the design and structure of Feathers that a significant amount of thought went into its development. Overall, I have been happy with the experience implementing clean APIs, and have added Feathers as my default toolchain for new web API and application development. Feathers has been great for building JSON-based RESTful APIs, but I stumbled over some hurdles when using it as a more traditional web application framework.]]></summary></entry></feed>